In the space of just a few years, the Internet, because it provides access to information, and the ability to publish information, in revolutionary ways, has emerged from relative obscurity to international prominence. Whereas, in general, an internet is a network of networks, the Internet is a global collection of interconnected local, mid-level, and wide-area networks that use the Internet Protocol (IP) as the network layer protocol. Whereas the Internet embraces many local- and wide-area networks, a given local- or wide-area network may or may not form part of the Internet.
As the Internet and its underlying technologies have become increasingly familiar, attention has become focused on Internet security and computer network security in general. With unprecedented access to information has also come unprecedented opportunities to gain unauthorized access to data, change data, destroy data, make unauthorized use of computer resources, interfere with the intended use of computer resources, etc. As experience has shown, the frontier of cyberspace has its share of scofflaws, resulting in increased efforts to protect the data, resources, and reputations of those embracing intranets and the Internet.
Security threats have evolved significantly with the increased popularity of the Internet. Advanced hybrid threats have been designed to attack systems on multiple fronts, sometimes searching for vulnerabilities until one is found. New threats also attempt to attack security technology itself.
Further, recent viruses use several techniques in order to spread very rapidly. In the time it takes for virus researchers to obtain a sample, analyze it, and release new signature files (i.e. DAT files, etc.), and for customers to obtain those signature files and distribute them to their computers; the virus can infect many, many computers.
One problem, therefore, involves protecting computers from new threats in this short period of time. Since no one knows when a new virus will be released and be successful, it is necessary for this protection to not cause any other problems.
Several years ago, technologies such as behavior blocking and file check summing were proposed as solutions to this problem, but they fell out of favor. This is because behavior blocking was not tuned enough to differentiate between legitimate and malicious behavior. Moreover, check summing fell out of favor because the advent of macro viruses meant that it became impossible to distinguish legitimate changes from malicious ones.
There is thus a need for overcoming these and other related security problems.